‹ All decisionslive
d_2419b815
INTERVENE2026-08-09 06:33:15 UTC · partner demo · threshold profile balanced · source live
Reasoning
Four long idle gaps plus tab switching with a pasted address is the clearest sign someone is walking the user through this in real time, and the 200/1000/4800 deposit ramp is the textbook small-win bait sequence. The brand-new one-off destination wallet and funds leaving within six minutes confirm a coached investment-scam shape rather than a self-directed first purchase.
idle_gaps_over_60s + tab_switches + pasted addressdeposit_escalation [200, 1000, 4800]fresh_eoa destination_first_seen_days 2minutes_to_outbound 6 on a 3-day-old account
Signal vector, as received
| Signal | Value | Contributed |
|---|---|---|
| account_age_days | 3 | — |
| is_first_purchase | true | — |
| amount_eur | 4800 | — |
| amount_vs_median | null | — |
| funding_method | card | — |
| minutes_to_outbound | 6 | yes |
| destination_first_seen_days | 2 | yes |
| destination_type | fresh_eoa | — |
| declined_attempts | 0 | — |
| address_entry_method | pasted | — |
| idle_gaps_over_60s | 4 | yes |
| tab_switches | 3 | yes |
| deposit_escalation | [200, 1000, 4800] | yes |
| kyc_retries | 0 | — |
| merchant_verified | null | — |
Probe transcript
Can you tell me what's going on with this transfer?
“I met someone on a dating app about two months ago. We talked every day, and he told me about this investment platform his uncle runs — it's how he gets early access to good entry prices.”
Amount
€4,800
User outcome
Not recorded
Model
claude-opus-5
Prompt fingerprint
pattern:b3378cbeb7e8 probe:8f9e2db8c06c verdict:2aaed03b60a9